Upper bounds on the performance of differential-phase-shift quantum key distribution 
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In this paper, we investigate limitations imposed by sequential attacks on the performance of a 
differential-phase-shift (DPS) quantum key distribution (QKD) protocol with weak coherent pulses. 
Specifically, we analyze a sequential attack based on optimal unambiguous discrimination of the 
relative phases between consecutive signal states emitted by the source. We show that this attack 
can provide tighter upper bounds for the security of a DPS QKD scheme than those derived from 
sequential attacks where the eavesdropper aims to identify the state of each signal emitted by the 
source unambiguously. 

PACS numbers: 



I. INTRODUCTION 

The niain security threat of quantum key distribution 
(QKD) protocols based on weak coherent pulses (WCP) 
arises from the fact that some signals contain more than 
one photon prepared in the same polarization state. In 
this situation, the eavesdropper (Eve) can perform, for 
instance, the so-called Photon Number Splitting (PNS) 
attack on the multi-photon pulses As a result, it 
turns out that the BB84 protocol with WCP can give 
a key generation rate of order 0{rf), where r] denotes the 
transmission efficiency of the quantum channel 0] ■ 

To obtain higher secure key rates over longer distances, 
different practical QKD schemes, that are robust against 
the PNS attack, have been proposed in recent years. One 
of these schemes is the so-called decoy-states 5], where 
the sender (Alice) randomly varies the mean photon num- 
ber of the signal states that are forwarded to the receiver 
(Bob). This method can deliver a secure key rate of or- 
der 0(77). Another possibility is based on the transmis- 
sion of two non-orthogonal coherent states together with 
a strong reference pulse @. This technique also pro- 
vides a key generation rate of order 0(77) Finally, 
another potential approach is to use a differential-phase- 
shift (DPS) QKD protocol [1,11]. In this scheme, Alice 
sends to Bob a train of WCP whose phases are randomly 
modulated by or tt. On the receiving side. Bob mea- 
sures out each incoming signal by means of an interferom- 
eter whose path-length difference is set equal to the time 
difference between two consecutive pulses. In this last 
case, however, a secure key rate of order 0(r?) has only 
been proven so far against a special type of individual 
attacks where Eve acts and measures photons individu- 
ally, rather than signals [9| , and also against a particular 
class of collective attacks where Eve attaches ancillary 
systems to each pulse or to each pair of successive pulses 
sent by Alice [1^. While a complete security proof of 
a DPS QKD protocol against the most general attack is 
still missing, recently it has been shown that sequential 
attacks 0] already impose strong restrictions on the per- 
formance of this QKD scheme with WCP. For instance, 
in [ll|, mi it was proven that the lorig-distance im- 
plementations of DPS QKD reported in 0, E HI, [i3| 



would be insecure against a sequential attack based on 
unambiguous state discrimination (USD) of Alice's signal 
states [Hill [13. 

In this paper, we investigate a novel sequential attack 
where Eve realizes unambiguous discrimination of the rel- 
ative phases between Alice's sigiral states, and we obtain 
ultimate upper bounds on the maximal distance achiev- 
able by a DPS QKD scheme as a function of the error 
rate in the sifted key, and the mean photon number of 
the signals sent by Alice. It states that no key distillation 
protocol can provide a secret key from the correlations 
established by the users. Moreover, we show that this 
attack can provide tighter upper bounds for the security 
of a DPS QKD scheme than those derived from a sequen- 
tial attack where Eve performs USD of each signal state 
emitted by Alice [uj, [ll, [11 . 

The paper is organized as follows. In section |TT] we 
describe in more detail a DPS QKD protocol. Then, in 
section IIIIl we present a sequential attack against this 
QKD scheme based on optimal unambiguous discrimina- 
tion of the relative phases between Alice's signal states. 
Here we obtain upper bounds on the performance of a 
DPS QKD scheme as a function of the error rate in the 
sifted key and the mean photon number of Alice's signal 
states. Finally, section IIVI concludes the paper with a 
summary. The manuscript contains as well one appendix 
with additional calculations. 



II. DIFFERENTIAL-PHASE-SHIFT QKD 

The basic setup is illustrated in figure [TJ Alice pre- 
pares first a train of coherent states |a) and, afterwards, 
she modulates, at random and independently every time, 
the phase of each pulse to be or tt. As a result, she pro- 
duces a random train of signal states la) or \ — a) that 
are sent to Bob through the quantum channel. On the 
receiving side. Bob uses a 50 : 50 beam splitter to divide 
the incoming pulses into two possible paths and then he 
recombines them again using another 50 : 50 beam split- 
ter. The time delay introduced by Bob's interferometer 
is set equal to the time difference At between two consec- 
utive pulses. Whenever the relative phase between two 
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FIG. 1: Basic setup of a DPS QKD scheme. PM denotes a 
phase modulator, BS, a 50 : 50 beam spUtter, M, a mirror, 
DO and Dl are two photon detectors and At represents the 
time difference between two consecutive pulses. 



consecutive signals is (±7r) only the photon detector 
DO {Dl) may produce a "click" (at least one photon is 
detected). For each detected event, Bob records the time 
slot where he obtained a click and the actual detector 
that fired. 

Once the quantum communication phase of the pro- 
tocol is completed. Bob uses a classical authenticated 
channel to announce the time slots where he obtained a 
click, but he does not reveal which detector fired each 
time. From this information provided by Bob, together 
with the knowledge of the phase value used to modulate 
each pulse, Alice can infer which photon detector had 
clicked at Bob's side each given time. Then, Alice and 
Bob agree, for instance, to select a bit value "0" when- 
ever the photon detector DO fired, and a bit value "1" 
if the detector Dl clicked. In an ideal scenario, Alice 
and Bob end up with an identical string of bits repre- 
senting the sifted key. Due to the noise introduced by 
the quantum channel, together with possible imperfec- 
tions of Alice and Bob's devices, however, the sifted key 
typically contains some errors. Then, Alice and Bob per- 
form error-correction to reconcile the data and privacy 
amplification to decouple the data from Eve. (See, for 
instance, [211].) 



III. SEQUENTIAL ATTACKS AGAINST 
DIFFERENTIAL-PHASE-SHIFT QKD 

A sequential attack can be seen as a special type of 
intercept-resend attack [ill, First, Eve mea- 

sures out every signal state emitted by Alice with a de- 
tection apparatus located very close to the sender. After- 
wards, she transmits each measurement result through a 
lossless classical channel to a source close to Bob. When- 
ever Eve obtains a predetermined number of consecutive 
successful measurement outcomes, this source prepares a 
new train of non-vacuum signal states that is forwarded 
to Bob. Otherwise, Eve typically sends vacuum signals 
to Bob to avoid errors [22 1. Whether a measurement 
result is considered to be successful or not, and which 
type of signal states Eve sends to Bob, depends on Eve's 
particular eavesdropping strategy and on her measure- 
ment device. Sequential attacks transform the original 



quantum channel between Alice and Bob into an entan- 
glement breaking channel (2^ and, therefore, they do not 
allow the distribution of quantum correlations needed to 
establish a secret key (2^ . 

The first sequential attack against a DPS QKD proto- 
col was introduced very briefly in Q. In this proposal. 
Eve employs a detection apparatus equivalent to Bob's 
setup. A successful result is associated with Eve obtain- 
ing a click in her measurement device. This click identi- 
fies unambiguously the relative phase (0 or ±7r) between 
two consecutive pulses emitted by Alice and, therefore, it 
reveals Eve the bit value encoded by the sender. A fail- 
ure corresponds to the absence of a click. However, since 
Alice emits WCP with typical average photon number 
quite low, so is the probability that Eve obtains a suc- 
cessful result in this scenario. In order to increase Eve's 
successful probability other sequential attacks have been 
proposed more recently [ll|, |l^ |13| . These attacks are 
typically based on Eve realizing USD of each signal state 
emitted by Alice, since Eve can always access a local os- 
cillator that is phase-locked to the coherent light source 
employed by the sender p^ . In particular, when Eve 
identifies unambiguously a signal state emitted by Alice, 
i.e., she determines without error whether it is \a) or 
I — a) , then she considers this result as successful. Oth- 
erwise, she considers it a failure. In ill] it was shown 
that this class of sequential attacks can provide tighter 
upper bounds on the performance of a DPS QKD pro- 
tocol than those derived from a sequential attack where 
Eve uses the same measurement apparatus like Bob. 

In this section, we introduce an improved version of 
the sequential attack proposed in [9] , and we investigate 
again the situation where Eve tries to identify the rela- 
tive phases between Alice's signal states unambiguously. 
As a result, it turns out that the attack we propose can 
provide stronger limitations for the security of a DPS 
QKD scheme than those reported in [ll|, [l^, [l^l ■ In our 
analysis we consider a conservative definition of security, 
i.e., we assume that Eve can always control some flaws in 
Alice's and Bob's devices {e.g., the detection efficiency, 
the dark count probability and the dead-time of the de- 
tectors), together with the losses in the channel, and she 
exploits them to obtain maximal information about the 
shared key. 



Optimal unambiguous discrimination between 
relative phases 



In a DPS QKD protocol Alice sends to Bob a train of 
WCP each of them prepared in the state |a) or \ — a). 
These coherent states can be expressed in some orthogo- 
nal basis {|0), |1)} as follows 



a|0) ±6|1) 



(1) 
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where we assume, without loss of generahty, that the 
coefficients a and h are given by 



a = \j i[l + cxp(-2^a)], 



b = \/-[l-cxp(-2^„)], 



(2) 



with /Zo 



denoting the mean photon number of 



AUce's signal states. That is, a and b satisfy: a e M, 
6 S M, + 6^ = 1, and a > b when ^ 0. 

The state of a block of M consecutive WCP emitted 
by Alice, that we shall denote as \'iI'{xm)), can be written 
as 



M 



IVX^Af)) 



1 



i—1 ni ,...,nM—0 

a^^-^fi^-^b^fL.-^\n,,...,nM), (3) 



with the coefficients a and b given by ([2]), and where 
the vector xm = (a;i, xm), with Xi G {0,1}, contains 
the information about the value of the phase (0 or tt) 
imprinted by Alice in each pulse within the block. 

In order to access to the relative phase information 
encoded in a block of signals sent by Alice, however, it 
is not necessary to completely identify the vector xm- 
For instance, the relative phase between pulse N and 
pulse — 1 in \i/j{xm)), with 2 < N < M, is simply 
given by (±7r) when xn © xn-i — (1). In general, 
for any given state \iP{xm)), there exists always another 

state \^P{xm ® 1m)), with xm © 1 m = (a^i © 1, ■■■,xm © 
1), that has precisely the same M — 1 relative phases as 
\iP{xm))- This means, in particular, that the problem 
of determining the relative phases of Alice's signal states 
can be formulated as a discrimination problem between 
2A/-1 j^ixed states given by 



1 



p{xm) = -{\iP{xm)){iP{xm)\ 



The goal is to keep the fraction of inconclusive outcomes 
as low as possible. 

Let the set of binary vectors ly.A/, with y G 
{A,B}, be defined as Vy^M = {("1, "m) | 
Ui e {0, 1}, and '^j even if y = A, odd if y = B}, 

and let yM denote the subspace spanned by the orthog- 
onal states {|ni, um)}, with the vectors (rii, um) G 
Vy^Af. The signal states p{xm) given by (g]) can be writ- 
ten in a block-diagonal form as 



P{xm)^ ^ Py,M|V'y(^M))(V'y(^M)|, 

where the probabilities Py^M are given by 



(6) 



Py,M 



E 



ni....,nM=0 



(7) 



with the vector Hm = {ni, hm), and where the states 
\^y{xM)) have the form 



1 



E (-1 



EM-l 



JPy,M ^ „ 
nM^VyM 

X a'^^^fir-^b^'i^-'\m,...,nM). (8) 



That is, the signals \i^y{xM)) e yjn- 

This means, in particular, that we can always assume, 
without loss of generality, that Eve's measurement strat- 
egy includes an initial step which projects the mixed 
states p{xm) onto the orthogonal subspaces Am and Bm ■ 
This projective measurement is characterized by the fol- 
lowing two operators: 



n 



Tii,...,riM=0 



ni. 



,nM){ni 



, "-Ml 



with 
tion 



y € {A,B}. It satisfies the 



(9) 



condi- 



xm = (xi, ...,a;M-i,0), 



(5) 



+ |V'(^M © lAf))(V'(^M © lM)|j, (4) \ijyixM)){^y{xM)\- That is, it outputs the state 

li'yixM)) with probability Pjy^Af. 
with the coefficient xm = 0. That is, the vector xm has The question of discriminating the 2^"'^ mixed states 
now the form given by ^ can then be reduced to the problem of dis- 

tinguishing 2^~^ pure states \tljy{xM))- To discriminate 
between the signals \tjjy{xM)}, we shall consider a mea- 
surement strategy which can involve at most M—1 steps. 
Before providing the exact details of the measurement, let 
us sketch very briefly its principal parts. Eve starts by 
performing a filter operation on |'0j,(xa/))- If the filter 
operation succeeds. Eve obtains xm-i (B xm- That is. 
Eve learns with certainty the relative phase between the 
first two pulses in the block. Moreover, this filter oper- 
ation also outputs a quantum state which still contains 
complete information about the remaining M — 2 relative 
phases within the block. On the contrary, if the filter op- 
eration fails, the value of xm-i is not accessible anymore. 



This last condition arises because 
...,a:M-i,0) = © 1, ...,a;M- 



with Xi G {0,1}. 

p{xm) satisfies p{xi, ...,xm-i,'J) = P\xi w 1, ...,x-m-i 
1,1). The normalization term i that appears in ([4]) is 
due to the fact that all the states |'0(xm)) have equal a 
priori probabilities. 

To distinguish between the signals states given by ([1]), 
we shall consider that Eve follows a USD strategy. That 
is, the constraint is that the measurement employed by 
Eve should never wrongly identify a state p(xm), but it 
can provide sometimes an inconclusive result [13, fl9l . [20| . 
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and Eve cannot obtain the first two relative phases {i.e., 
Xm-i(Bxm, and a::M-2 ffia^M-i) within the block. In this 
last case, however, the filter operation outputs a state 
which contains information about the remaining Af — 3 
relative phases within the block. Eve repeats the same 
procedure several times, but now applied to the quan- 
tum state provided by the filter operation in the previ- 
ous step. To gain full information about all the relative 
phases contained in \^y^M{x)), Eve needs to obtain 
consecutive successful filtering results. 

The main motivation to select such a particular im- 
plementation of a USD measurement is closely related to 
Eve's eavesdropping strategy, which will be introduced in 
section IIII Bl The principal idea behind this method is 
that, with some finite probability. Eve can always deter- 
mine the value of some relative phases in \ipy{xM)), even 
if she is not able to identify all of them. Moreover, as we 
show in [XI it turns out that this measurement strategy 
is optimal, i.e., it minimizes the probability of obtaining 
an inconclusive result when distinguishing all the M — 1 
relative phases of Alice's signal states. Next, we provide 
the technical details of Eve's measurement. 

The set of M — 1 possible filter operations employed 
by Eve is defined by the following two Kraus operators: 



,N = Gy,Ar_i® |0)(0|+/Ar_i® |1)(1|, (10) 



Ffail,y,N — (-^JV-1 — G'^y.N-l^V,N-lY^'^ ' 



with 2 < N < M , and where In-i denotes the identity 
operator in 7i2«-i, and the operator Gy^N-i is given by 



G 



1 

y,N-l = ^ 

ni,...,r!N-l=0 



2(rijv-iei) 



(11) 



X |ni,n2, ...,nN-i ® l)(ni,n2, ...,nN-i\. 
Let \(l)y{xN)) denote a quantum state of the form 

1 



1 



ni,...,n7v— 



(12) 



with 1 < N < M. That is, when N ^ M these states 
satisfy \(j)y(xM)) = li'vixAi)) for all xm given by ([5|). Let 
xn-i denote the vector that is formed by the first A^ — 1 
elements of xm- For any N satisfying 2 < N < M, the 
signal states given by (|12p can be written as a function 
of \<py{xN-i)) and \(l)y{xN-i)) , with y = B when y = A 
and y — A when y = B, as 



|0y(xAr)) = 



1 



a^/Py,N-l\(t>y{xN-l))\'^) (13) 



+ (-i)^~-®^~6vp^:]^i0,(xjv_i))ii)). 



up to a global phase. 



Suppose now that the filter operation defined by (flO)) 
receives as input the state |V'y(afM)) = |</'y(^j\/))- The 
probability of getting a successful result, that we shall 
represent as Psucc,y,M, can be calculated as Psucc,y,M = 
(0y(^M)|^'Lcc,y,M-^s"cc,y,M|0y(^M))- This quantity is 
given by Psucc,y,M = {Py,M)~^'2b'^Py,M^i- If the filter op- 
eration succeeded, the resulting normalized filtered state, 
that we shall denote as \4>succ,y{xM)) , can be calculated 

as \(f>succ,yixM)) = iy/Psucc,y,M)''^ Fsucc,y,M\4'y{^M)) . 

We obtain |0sncc,y(^A/)) = \4'yixM-i)) ^ I^/'i/.m), with 
the state IV'y.A/) given by IV'y.Af) = (a/2)~1[|0) + 
(-l)^'^-i®=^*^|l)], up to a global phase. That is, the rel- 
ative phase between pulse M and pulse M — 1 is now 
completely accessible to Eve. She only has to mea- 
sure the state |V'y,A/) in the orthogonal basis |±) = 
(V2)-^(|0) ± |1)) to learn its value. 

On the contrary, the probability of obtaining a fail- 
ure, that we shall denote as Pfaii,y,M, can be calcu- 
lated aSpfaa,y,M = {(l)y{xM)\Fj^.iyj^jFfaU,y,M\(l)y{xM)). 

This quantity is given by Pfaii,y,M = {Py,M)~^i^ - 
2b^)py^M-2 = 1 — Psucc,y,M- Whenever the filter oper- 
ation failed, the resulting normalized filtered state, that 
we shall denote as \(t>faii,y{xM)), can be calculated as 

\4'fail,y{xM)) = {y/PfaiLy,M)'^Ffail,y,M\4'y{xM)). Wc 

obtain |(/)/ai/,y (xm)) = \(t>y{xM-2)) <8i |00), up to a global 
phase. That is, if Eve fails when filtering the state 
\(f)y(xM)), then the value of xm~i is not accessible to 
her anymore, and Eve cannot obtain the relative phase 
information between pulse M and pulse M — 1 , and also 
between pulse M — 1 and pulse M — 2, within the block. 

Once the first filter operation finished, Eve is left with 
a quantum state which contains the signal \(j)y{xM-i)) if 
the filter succeeded, or the signal \(j)y{xM-2)) if it failed. 
Then, she can repeat the same procedure again, and filter 
these signal states to try to obtain xm-2 ffi xm-i if the 
original state was \4>y{xM-i)) , or xm-3 ® xm-2 if it was 
\4'y{^M-2)) ■ In general, whenever a filter operation given 
by (flOl) receives as input the state |0j,(a;jv)), with 2 < 
N < M, then the probability of getting a successful result 
is given by 



Psucc,y,N 



2b 



2 Py.N-l 

Py,N 



(14) 



If the filter operation succeeded, the resulting normalized 
filtered state has the form 

\4'succ,yixN)) = \(l)y{xN^l)) » |V'j/,iv), (15) 

with the signal |'(/'y,jv) given by 



|^,,^) = -^[|0) + (-l) 



1) 



(16) 



up to a global phase. On the contrary, the probability of 
obtaining a failure can be expressed as 



/I r,u2\Py,N-2 

Pfail,y,N = (1 - 2£) ) , 

Py,N 



(17) 



5 



with the probabilities pA,o = 1 and pb,o = 0. In this last 
case, the resulting normalized filtered state is given by 

l0/ai;,a(^Jv)> = \(l>y{xN-2)) «) |00), (18) 

up to a global phase. 

Let us now calculate the probability that Eve learns 
the first k S [l,M — 1] relative phases of p{xm)- As we 
have seen above, to obtain the relative phase between 
pulse N and pulse iV — 1 within a block of M signals 
sent by Alice, Eve has to successfully filter a state of 
the form \(j)y{xM))- Let Psucc,N denote the probability 
that Eve obtains the value of xn~i ® conditioned on 
the fact that Eve has access to a signal 10^(5; at)), with 
y £ {A, B}. This probability can be written as 

Psucc.N — ^ P^Psucc,y,N, (19) 
V&{A,B} 

where p^ represents the probability that the state fil- 
tered by Eve when trying to obtain x^v-i O xn belongs 
to the subspace JV- When N = M, we have that 
pI,j is simply given by plj = Py,M, with py^M of the 
form ([7]). This means, in particular, that Psucc,M ~ 
2&^(py,Af-i +py^M-i) = 26^, since Py,M-i +Py,M-i = 1- 
If = i\/ — 1, the probabilities p\j_i can be expressed 

aspX/-i = {Psucc,M)~^PMPsucc,y,M- Using together 
with the fact that PsuccM = and p\j = Py^M, we 
obtain = Py,M-i- That is, Psucc,M-^ is given 

PsuccM -I = '^b'^{Py,M-2 + Py,M-2) = 26^. Simi- 
larly, when 2 < N < M ~ 2, the state |</>y(ifAr)) can 
only arise from a filter operation on a signal \(j)y{xN-f^i)) 
that succeeded, or from a filter operation on a signal 
\4'yi^N+2)) that failed. If it comes from a successful 
filter operation on \(f>y{xN-i-i)) , then pj(f can be writ- 
ten as = iPsucc,N+iy^PN+iPsucc,y,N+i- Starting 
with the case N = M — 2, we already showed that 
PsuccM -1 = 2fo^ and p^f-i = PyM-i- This means, 
therefore, that p\.f_2 = PyM-'^- the state \(j)y{xN)) 
arises from a filter operation on \(f)y{xN-i.2)) which failed, 
then is given by = ipfaii,N+2)~^PN+2Pfaii.y.N+2- 
Starting again with the case N = M ~ 2, and using p7)) 
together with the fact thatp/ai;,Af = PsuccM ~ 1 — 26^ 
and p\f = Py,M , have that p\f_2 = Py,M-2 also in this 
scenario. Finally, from (jl9p we obtain that Psucc,M-2 sat- 
isfies PsuccM -2 = 26^. Following a recursive argumenta- 
tion, it is straightforward to show that 

Psucc.N = 26^ = 1 - cxp (-2/1^), (20) 

for all N satisfying 2 < N < M, and where in the last 
equality we have used ([2]). This means, in particular, that 
the probability that Eve learns the first k e [1, A/ — 1] 
relative phases of p(xm) can now be expressed as 

fc-i 

W PsuccM-^ = [1 - exp {-2iia)]^, (21) 

As already mentioned before, it can be proven that this 
measurement is optimal, i.e., it minimizes the probability 



of having an inconclusive result when distinguishing all 
the relative phases of Alice's signal states. (See Appendix 

S) 

B. Eavesdropping strategy 

For simplicity, we shall consider that Eve treats all the 
signal states sent by Alice as a single block of signals, 
and she tries to discriminate each relative phase within 
the block. Whenever she identifies unambiguously a pre- 
determined number of consecutive relative phases sent 
by Alice, i.e., she determines without error whether each 
relative phase is or ±7r, she considers this sequence of 
measurement outcomes successful. Otherwise she con- 
siders it a failure. We define the integer parameter Mmin 
as the minimum number of consecutive relative phases 
that Eve needs to correctly identify in order to consider 
the sequence of measurement outcomes successful. More 
precisely, if /c > denotes the total number of consecu- 
tive relative phases unambiguously identified by Eve be- 
fore she obtains an inconclusive result, then, whenever 
k > Afniin, Eve prepares a new train of signal states that 
is forwarded to Bob. On the other hand, if < Mmin Eve 
sends to Bob k + 2 vacuum states, where the last vacuum 
state corresponds to Eve's inconclusive result. Finally, 
whenever k — Afmin we shall consider that Eve employs 
a probabilistic strategy that combines the two previous 
ones. In particular, we assume that Eve sends to Bob a 
new train of signal states with probability q and, with 
probability 1 — <?, she sends to Bob A/min + 2 vacuum 
states. That is, the parameter q allows Eve to smoothly 
fit her eavesdropping strategy to the observed data plj . 

Moreover, for simplicity, we define the integer param- 
eter Afmax > -^^min as the maximum number of consec- 
utive unambiguous discrimination successful results that 
Eve can obtain in order to send to Bob a train of sig- 
nal states. That is, whenever Eve determines unambigu- 
ously Afniax consecutive relative phases within a block 
of them then she discards the next two phases, sends to 
Bob a train of signal states, and begins again the mea- 
surement process of the remaining phases. The reason to 
discard two consecutive relative phases in this scenario is 
just to guarantee that between any two blocks of signal 
states sent by Eve there always exists, at least, one vac- 
uum state. Specifically, suppose, for instance, that after 
-^^max successful rcsults. Eve's filter operation outputs, 
with probability p^, a state \(j)y{xN)) given by p^ . For 
N > 2, the state \(j)y{xN)) can be written as 

\(l)yixN)) = / {y/Py,N-2\(f>y{xN-2)}[a^\00}c 

^/Py,N ^ 

+ {-ir^-'®^^h'\ll)c\+ab^/p-J-l 

X |0,(fA._2))[(-l)-«-®-«|Ol)c, 

+ (-l)='"-^®='"-i|10)p]}, (22) 
up to a global phase. If now Eve discards subsys- 
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tern C, the resulting signal state can be expressed as 
Y.ye{A,B}PN^'^c{\(l>v{xN)){(t)y{xN)\)- After some calcu- 
lations, and using the fact that p^j^ = py^N (see Section 
nil Al) . we obtain that this state is of the form given by 
([5]), with M = N — 2. That is, the value of xat-i is not 
accessible anymore, but Eve can start again her measure- 
ment strategy on p(xN-2)- 

Let us now introduce the type of signal states that Eve 
forwards to Bob when she obtains Afmin < k < Mmax 
consecutive successful measurement outcomes. To guar- 
antee that Eve's presence remains unnoticeable to the 
legitimate users, she needs to select these signal states 
such that they can reproduce the statistics expected by 
the legitimate users after their measurements. For this, 
we shall consider the standard version of a DPS QKD 
protocol, where Alice and Bob only monitor the raw bit 
rate (before the key distillation phase) together with the 
time instances in which Bob obtains a click. It was shown 
in (l3| that the main limitation on the class of signal 
states that Eve can send to Bob in this scenario arises 
from the dead-time of Bobs detectors. In particular, to 
be able to mimic the expected dead-time of the detec- 
tors. Eve has to select trains of signal states that can 
produce only one click on Bob's side within a dead-time 
period [l^. To achieve this goal, we shall assume that 
whenever Eve identifies k consecutive relative phases en- 
coded by Alice then she chooses her signal states, that 
we denote as \tpg), containing only one photon distributed 
among fc -|- 1 temporal modes. These modes correspond 
to fc -|- 1 consecutive pulses sent by Alice, i.e., the time 
difference between any two consecutive temporal modes 
is set equal to the time difference At between two con- 
secutive pulses. Specifically, we shall consider that the 
states are given by 



fc-i-i 



(23) 



with the coefficients A^^' e C and where the normal- 
ization condition X]n=il^"^''P = 1 is always satisfied. 
The angles 9n are selected such that they reproduce 
the relative phases identified by Eve's measurement, i.e., 
Sn — Sn-i, with 1 < n < -|- 1, is equal to the relative 
phase between pulse n and pulse n—1 sent by Alice. The 
operator aj^ represents a creation operator for one pho- 
ton in temporal mode n, and the state \vac) refers to the 
vacuum state. The superscript k labeling the coefficients 
aH^'' emphasizes the fact that the value of these coef- 
ficients may depend on the number of temporal modes 
contained in \ip^). 

Eve also appends some vacuum states to each signal 
The main idea behind this procedure is to guaran- 
tee that whenever Bob obtains a click on his detection 
apparatus, then he cannot obtain any other click after- 
wards during a period of time at least equal to the dead- 
time of his detectors. The minimum number of vacuum 
states that Eve needs to send to Bob after each signal 
I V'e ) is given by 1 -I- d, with d = \tdfc] , and where and 



A) 

1+d vacuum 



M 



P,(k) 



B) 



k+2 vacuum 



< k < M„ 



FIG. 2: Possible signal states that Eve sends to Bob together 
with their a priori probabilities. The arrow indicates the 
transmission direction. 



/c denote, respectively, the dead-time of Bob's detectors 
and the clock frequency of the system [l^. The mini- 
mum value of d arises from the case where Bob obtains a 
click in the last possible temporal mode. Whenever Eve 
forwards to Bob a state together with 1 + d vacuum 
states then she also has to discard some extra relative 
phases of \(/)y{xN)) according to the procedure explained 
above before she begins again with her measurement of 
the remaining relative phases within the block. 

In section lTlI Al we showed that, given p{xm), the prob- 
ability that Eve learns the first k € [1,M — 1] relative 
phases of p{xm) is given by p'' with 



p = 1 - exp {~2fia). 



(24) 



This means, in particular, that the probability that Eve 
sends to Bob a train of signal states |V'o): together with 
1 + d vacuum states, is given by 



Ps{k) = 



<7P*^-°(1- 




P) 



ilk 
il M„ 
ilk 



'mm 

otherwise, 



<k< M„ 



(25) 



with p given by (|24p . Similarly, we shall denote with 
Pv(k) the probability that Eve sends to Bob k + 2 vacuum 
states. This probability is given by 



Pvik) 




iiO<k< Af,nin 
p) if/c^Mmin 

otherwise. 



(26) 



We illustrate all these possible cases in figure [21 where 
we also include the different a priori probabilities to be 
in each of these scenarios. 

Next, we obtain an expression for the gain, i.e., the 
probability that Bob obtains a click per signal state 
sent by Alice, together with the quantum bit error rate 
(QBER) introduced by Eve with this sequential attack. 
The analysis is analogous to that included in but 
now taking into account the a priori probabilities Ps{k) 
and Pv{k) given by (|^ and (pS)) . respectively. 
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C. Gain 

The gain, that we shaU denote as G, can be expressed 
as G = iVciicks/-^sj where iVdicks represents the average 
total number of chcks obtained by Bob, and Ng is the to- 
tal number of signal states sent by Alice. The parameter 
A'^ciicks can be expressed as iVcUcks = {Ns/N'')N^^^^y.^, with 
denoting the average total number of pulses of the sig- 
nal states sent by Eve (see figure [2]), and where N^n^ks 
represents the average total number of clicks obtained by 
Bob when Eve sends to him precisely these signal states. 
With this notation, the gain of a sequential attack can 
be written as 



clicks 



(27) 



Let us start by calculating iV°iicks- Whenever Eve sends 
to Bob a signal state \'^^) followed by 1 + d vacuum states 
(Case A in figure [2|) Bob always obtains one click in his 
detection apparatus. On the other hand, if Eve sends to 
Bob only vacuum states (Case B in figure [2]) Bob never 
obtains a click. This means, in particular, that A'^ijcks 
can be expressed as 

A^ciicks- E Ps(fc)-/^™(p + 9-M). (28) 

The analysis to obtain iV"*^ is similar. A signal state IV'o ) 
followed by l-l-d vacuum states can be seen as containing 
A;+2+(i pulses. On the other hand, the number of vacuum 
pulses alone that Eve sends to Bob can vary from 2 to 
-Mmin + 2 (see figure 121) ■ Adding all these terms together, 
and taking into account their a priori probabilities, we 
obtain that iV^ can be written as 

= £ Pv(fc)(fc + 2)-Hps(fc)(fc + 2-f(i) 

fe=0 

2 - P - p^^»ax + l 



1-p 



'^-^clicksJ 



(29) 



with ^clicks given by 

The gain G can be related with a transmission distance 
I for a given QKD scheme, i.e., a distance which provides 
an expected click rate at Bob's side given by G. This last 
condition can be written as 



tance / that provides a gain G is given by 



From (1301) and (131]). we find that the transmission dis- 



(32) 



7 



L + lOlog 



10 



-ln(l-G) 



D. Quantum bit error rate 



The QBER, that we shall denote as Q, is defined as 
Q = iVorrors/A^ciicks, whcrc A^errors represents the average 
total number of errors obtained by Bob, and A'cUcks is 
again the average total number of clicks at Bob's side. 
The parameter A'orrors can be expressed as A'orrors — 
(As/A^°)A^j.j,Qj.g, with A^^j-rors denoting the average total 
number of errors obtained by Bob when Eve sends him 
the different signal states considered in her strategy (see 
figure [2]). With this notation, and using again the fact 
that A^ciicks = (^s/A^°)A^ciicks' we obtain that the QBER 
of a sequential attack can be expressed as 



clicks 



(33) 



The parameter A^^ij^ks was calculated in the previous sec- 
tion and it is given by (|^ . In order to obtain an expres- 
sion for A^|j.j.Qj.g, one can distinguish the same cases like 
in the previous section, depending on the type of signal 
states that Eve sends to Bob. Whenever Eve sends to 
Bob a signal state |V'o ) followed by 1 -f- d vacuum states 
(Case A in figure [2|) , the average total number of errors 
in this scenario, that we shall denote as e(fc), is given by 



(34) 



On the other hand, if Eve sends to Bob only vacuum 
states (Case B in figure [2]) Bob never obtains an error. 
This means, in particular, that N^^^.^^.^ can be expressed 
as 



^errors = E ft(fe)e(fc). 

fc=A/„i„ 

E. Evaluation 



(35) 



G 1 - exp (-HaVdctVt) 



(30) 



where r^det represents the detection efficiency of Bob's de- 
tectors, and rjt denotes the transmittivity of the quantum 
channel. In the case of a DPS QKD scheme, the value of 
r]t can be derived from the loss coefficient 7 of the opti- 
cal fiber measured in dB/km, the transmission distance 
I measured in km, and the loss in Bob's interferometer L 
measured in dB as 



Vt = 10- 



(31) 



The sequential attack introduced in section IIII Bl can 
be parametrized by the minimum number Mmin of con- 
secutive unambiguous discrimination successful results 
that Eve needs to obtain in order to consider the se- 
quence of measurement outcomes successful, the maxi- 
mum number iWmax of consecutive successful results that 
Eve can obtain in order to send to Bob a train of signal 
states, the value of the probability q, i.e., the probabil- 
ity that Eve actually decides to send to Bob the signal 
state l')/)^'"'") followed by 1 -I- d vacuum states instead 



of M„ 



2 vacuum states, and the state coefficients 
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Log,o(G) 



FIG. 3: Gain (G) versus QBER in the sequential attack in- 
troduced in section IIII Bl for the optimal distribution of the 
state coefficients A^n^ (solid line). The dashed line represents 
a sequential USD attack [l^. The mean photon number of 
Alice's signal states is fi^ = 0.2, and the parameter d = 500. 
The triangles represent experimental data from [l7| ]. 



An G C that characterize the signal states |V'o)j with 

Mmin <k< Mn,ax. 

Figures [21 [H E] and [5] show a graphical representation 
of the gain versus the QBER in this sequential attack for 
different values of the mean photon number of Alice's 
signal states, and the parameter d. It states that no key 
distillation protocol can provide a secret key from the 
correlations established by the users above the curves, 
i.e., the secret key rate in that region is zero. In these 
examples we consider the optimal distribution for the 

state coefficients An , i.e., the one which provides the 
lowest QBER for a given value of the gain. This dis- 
tribution was obtained in where it was shown that 

(k) (k) 

the vector of optimal state coefficients {A\ , Aj._^^) co- 
incides with the normalized eigenvector associated with 
the maximal eigenvalue of a (fc -I- 1) x (fc -I- 1) matrix with 
ones only on the first off-diagonals and zeros elsewhere. 
These figures assume that M^ax is fixed and given by 
Mmax = 25, and we vary the parameters M^in < M^ax 
and q G [0, 1]. These examples also include the case of a 
sequential attack where Eve realizes USD of each signal 
state sent by Ali ce |13| . together with experimental data 
from [3, [TsI ITgI . Il7l|. For instance, in the experiment re- 
ported in [l7!| the dead-time of Bob's detectors is td = 50 
ns and the clock frequency of the system is /c — 10 
GHz. We obtain, therefore, that d = \tdfc\ = 500. 
(See figure [3l) Similarly, in the experiments realized in 
111, EE dl we have that td = 50 ns and /c = 1 GHz. 
This means, in particular, that in all these cases d = 50. 
(See figures HE] and H) 

According to these results, we find that the sequential 
attack proposed in section IIIIBI can provide tighter up- 
per bounds for the security of a DPS QKD scheme than 
those derived from a sequential attack where Eve per- 
forms USD of each signal state emitted by the source. 
Basically, this result arises due to the different a priori 
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FIG. 4: Gain (G) versus QBER in the sequential attack in- 
troduced in section IIII Bl for the optimal distribution of the 
state coefficients aI^^^ (solid line). The dashed line represents 
a sequential USD attack [l^. The mean photon number of 
Alice's signal states is fia = 0.17, and the parameter d — 50. 
The triangles represent experimental data from 14] . (See also 
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FIG. 5: Gain (G) versus QBER in the sequential attack in- 
troduced in section IIII Bl for the optimal distribution of the 
state coefficients aI^^^ (solid line). The dashed line represents 
a sequential USD attack [l^]. The mean photon number of 
Alice's signal states is fia = 0.16, and the parameter d — 50. 
The triangle represents experimental data from 14| . (See also 



probabihties of Eve sending to Bob a train of signal states 
together with 1 -I- d vacuum states, in each of these 
two possible attacks. In particular, while in the attack 
introduced in section IIIIBI these probabilities are given 
by Ps{k), in a sequential USD attack these probabilities 
have the form Ps{k)p, with p given by (|24p . Note that in 
this last case Eve has to discriminate the state of fc -I- 1 
consecutive signals sent by Alice unambiguously. 
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FIG. 6: Gain (G) versus QBER in the sequential attack in- 
troduced in section IIII Bl for the optimal distribution of the 
state coefficients A^n^ (solid line). The dashed line represents 
a sequential USD attack H^. The mean photon number of 
Alice's signal states is — 0.2, and the parameter d = 50. 
The triangles represent experimental data from (isj. (See also 

IV. CONCLUSION 

In this paper we have analyzed hmitations imposed by 
sequential attacks on the performance of a diffcrential- 
phase-shift (DPS) quantum key distribution (QKD) pro- 
tocol based on weak coherent pulses. A sequential attack 
consists of Eve measuring out every coherent state emit- 
ted by Alice and, afterwards, she prepares new signal 
states, depending on the results obtained, that are given 
to Bob. Whenever Eve obtains a predetermined number 
of consecutive successful measurement outcomes, then 
she prepares a new train of non- vacuum signal states that 
is forwarded to Bob. Otherwise, Eve can send vacuum 
signals to Bob to avoid errors. Sequential attacks trans- 
form the original quantum channel between Alice and 
Bob into an entanglement breaking channel and, there- 
fore, they do not allow the distribution of quantum cor- 
relations needed to establish a secret key. 

Specifically, we have investigated a sequential attack 
where Eve realizes optimal unambiguous discrimination 
of the relative phases between Alice's signal states. When 
Eve identifies unambiguously the relative phase between 
two consecutive signal states sent by Alice, then she con- 
siders this result as successful. Otherwise, she considers 
it a failure. As a result, we obtained ultimate upper 
bounds on the maximal distance achievable by a DPS 
QKD scheme as a function of the error rate in the sifted 
key, and the mean photon number of Alice's signals. It 
states that there exists no improved classical communi- 
cation protocol or improved security analysis which can 
turn the correlations established by the users into a secret 
key. Moreover, our analysis indicates that this attack can 
provide tighter upper bounds for the security of a DPS 
QKD scheme than those derived from sequential attacks 
where Eve performs unambiguous state discrimination of 
each signal state emitted by the source. 
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APPENDIX A: OPTIMALITY OF EVE'S 
MEASUREMENT 

In this appendix we show that the unambiguous dis- 
crimination measurement presented in section IIII Al is 
optimal, i.e., it minimizes the probability of having an 
inconclusive result when distinguishing all the relative 
phases between Alice's signal states. For that, we calcu- 
late the maximal probability of unambiguously determin- 
ing all the relative phases contained in the signal states 
p{xm) given by ([S]), and we show that this probability 
coincides with that provided by the measurement intro- 
duced in section IIII Al 

As already mentioned before, due to the special block 
structure of the signal states p{xm), we can always as- 
sume, without loss of generality, that Eve first projects 
p{xm) onto the orthogonal subspaces Am and Bm and, 
afterwards, she measures the relative phase information 
contained in \ipy{xM)), with y £ {A,B}. 

The set of states |?/'y(^M)) G yjvi constitutes a so- 
called geometrically uniform (GU) set [H, That is, 
these states are defined over a group of unitary matrices 
and they can be generated by a single generating vector. 
In particular, let Q be the finite group of 2*^^^ unitary 
matrices U{xm) defined as 

1 

U{xm) = J2 (-l)^''""'"'l"l,-,«Af> 

rii,...,nj\/=0 

X (ni, ...,nA/|, (Al) 

with xm given by ([5]). If we denote as Om — (Oi, ...,0m) 
the vector that has all its M elements equal to zero, then 
the states {ipyixM)) can always be written as \ipy{xM)) = 
U{xM)\ipy{OM)), with IV'a(OM)) being the generating vec- 
tor of the set. 

Let $j^,M denote the matrix whose columns are the 
state vectors I'ipyixM)), and let represent its conju- 

gate transpose. It was proven in [27[ that the maximal 
probability of correctly distinguishing between GU pure 
states with equal a priori probabilities is given by the 
smallest eigenvalue of ^y,M^l^M- The matrices $y,Af, 
with y e {A, B} and M > 3, can be written, respec- 
tively, as 
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1 / a^/PA,M-l^A,AI-l ay/pA,AI-l^A,AI-l 

y/PA,M \ by/PB,M-l^BAI-l ~b^pB,M-l^BM-l 

1 / a^PB,M-l'^BM-l -a^PB,M-l^B,M-l 

y/PB,M \ by/PA,M-l^A,M~l b^PA^M-l^A,M-l 



(A2) 



r 



where ^y^M-i denotes the matrix whose columns are the 
state vectors \(f>y{xM-i)) given by (|12p . This means, in 



particular, that ^y,M^l m "^^^ t)e expressed as a block- 
diagonal matrix as 



(5 ** W 2a'Pj;,Af-i$y.M-i$ 



Py,M 



y,M~l 



2b'- 



'pyM-i^yM-i^,M- 



(A3) 



with denoting a zero matrix, i.e., a matrix which con- 
tains only zeros. The smallest eigenvalue of ^y,M^l 
that we shall denote as A™]j}, is given by 



With A™i5_, 



0^2„ \min Oh^^ 

Py,M-l\^M-l Py,M-l\_ 



min 



Py,M 



Py,M 



(A4) 

denoting the smallest eigenvalue of 



^y^M-i'^l^M-i- We solve (|A4I) by induction. In par- 
ticular, we start by analyzing the case M — 2^ and then 
we show that 



PyM-'^'^y.M-l 



^ ^0 Py,M-lAy ]^_j_i, 



(A5) 



for all Af > 3. 

When M = 
(PA2)-M2a^0;0,2&4], 



2, we have that ^a,2^*a 2 



and 



B.2 



(ps,2)"M2a^fe^,0;0,2a262]. Then, since a > 6, it is 
guaranteed that 2a^ = 2a^pA,i > 26'* = 2b^pB,i, 
and 2a^6^ = 2a^ps_i = 2b^pA,i, respectively. That 
is, if we define A;^f = 1 for aU y G {A,B}, 
then (|A5P is satisfied. When A/ ~ 3, it turns 
out that 2a^pA,2\T2 = '^b^PB,2>^B%' = 40^6^ 
and 2a'^pB,2>^"B2 = 40-*^^ > S&^p^.aAT" = 46^ 



That is, (IA5I) is also satisfied. 



that 2a'py^M^2KZ^ 



> 



A,2 

Let us now assume 
is true. 



20 PyM-2\^M- 



Then, from (jA4p we have that 2a^py^M-iX 
2a^min { 

2a'2b''p,-,.M^2\TS^. > 2b''2b''pyM-2>^'^Z-2 



min 
y,M-l 



20 PyM-l>^yM-l- 

This means, therefore, that A™^*} is given by 
1 



a: 



y,M 



^0 Py^M-l\^M~ 



Py,M 

Affim 



(A6) 



where in the last equality we have used (|14p . When M 
is even, this expression can be written as 



M/2 



M/2-1 



\min I I I I 

y,M — 11 Psucc.y,2i I I Psucc,y,2j-\-l: 

i=l j=l 



while, whenever M is odd then (IA6I) has the form 



(A7) 



(Af-l)/2 

(A8) 



The maximal probability of unambiguously determin- 
ing all the relative phases contained in the signal states 
pIxm) is given by 



Py,M^y,M- 

ye{A,B} 



(A9) 



After some straightforward calculations, we obtain that 
this quantity can be written as [1 — exp (— 2/iQ)]*^^*, 
which coincides with that obtained in section UlIAl 
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